lowkernelverified ✓rollback-safe
Disable hfsplus kernel module
kmod-disable-hfsplus · RHEL ≥ 8 · 1 impl
Description
The hfsplus filesystem is the Apple Extended HFS. It is rarely needed on production Linux systems and provides an unnecessary attack surface.
Rationale
Removing support for unnecessary filesystems reduces the kernel attack surface. A vulnerability in an unused filesystem module could be exploited if loadable.
Check → Remediate
Checkkernel_module_state
- name:
- hfsplus
- state:
- blacklisted
Remediatekernel_module_disable
- name:
- hfsplus
Framework references
CIS
rhel8 1.1.1.4rhel9 1.1.1.4rhel10 1.1.1.4
NIST 800-53
CM-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#kernel-module#filesystem#attack-surface